CONFIDENTIALITY POLICY IN FORCE FROM 01/04/2024

This document seeks to inform you of our practices for processing and protecting your Personal Data(“Data”), as defined below, obtained from the site https://drouot.com/ andhttps://www.moniteurdesventes.com/ (“The Platforms”), in strict compliance with your rights.
We encourage you to read all the information we provide carefully and to please contact us if you haveany questions.
1. Definitions"Data": means any information which, directly or indirectly, enables a natural person to be identified byreference to an identification number or to one or more elements specific to it. You will never be asked
to enter so-called “sensitive” personal data, such as your racial or ethnic origins, your political,
philosophical or religious opinions, or information concerning your income or tax situation.
Your Data are only collected for the strict use and understanding of the Platforms as well as the purposes
described in Article 4.
Drouot SI acts as the data controller for your Data that is collected during the use of our Services and the
Platforms to provide you with the Services. This means that Drouot SI is, in particular, responsible for its
collection, security and use for the purposes described herein, in compliance with the Data Protection
rules.
Drouot does not loan or transfer its customer files to third party commercial companies unrelated to theServices as defined herein.
"Services": Drouot SI provides websites that allow you to:- participate remotely by electronic means on the website https://drouot.com/ (the “Drouot
Platform ”) and on https://www.moniteurdesventes.com/ (“the Moniteurdesventes
Platform”):• in public auctions broadcast live (“Live Sales”),• in auctions taking place only on the internet (“Timed Sales”);• in fixed-price sales (“BuyNow Sales”)
The Services are described in the General Terms and Conditions of Use of the Platforms (the “General
Terms of Use”).
"Drouot SI" / "We": the Services are provided by Drouot SI, 9 rue Drouot – 75009 Paris, SAS withcapital of 50,000 euros registered in the Paris Trade and Companies Register under number 790 095 780.
“User” / “You”: means any natural person using the Platforms.
2. Consent
By using our Services and subscribing to the Platform, you undertake to provide genuine information
about you and understand and agree that your Data may be collected, used, stored and disclosed to third
parties as described below for the purposes of providing the Services to which you wish to subscribe.
The disclosure of false information is contrary to the General Terms and Conditions of Use.

1

3. Data collected
We may collect the following categories of Data:a. Site Navigation
Connection data. Every time you log into one of the Platforms, we passively collect information such as,
in particular, your computer’s IP address, the date and time of connection, together with information
about your browser.
Navigation data. We also collect information to identify how you access one of the Platforms, which
pages are viewed and for how long.
We may use Cookies as specified below.
b. Creating an AccountIn accordance with the General Terms and Conditions of Use, when you create an Account on one of the
Platforms (“Account”), you will be asked to enter a certain amount of Data, in particular your first andlast names, your postal address, your email address, your telephone number, date of birth, etc.
We also ask that you send us your ID.
This information is required by sales operators organising auctions, in which you register to place Absentee
Bids and bid, to comply with the legal obligation to formally identify their customers, to which they are
subject in particular in the context of anti-money laundering. Account creation information is also needed
to manage the customer relationship between Drouot SI and Users and is necessary for the use of one of
the Platforms.
c. Absentee Bids and online auctions with an AccountWhen submitting an Absentee Bid online (“Absentee Bid”) or when you bid online, we collect certain
information such as the history and details of your purchases, the number and amounts of your bids, etc.
d. Bank data
When you register for a sale on one of the Platforms, your bank details are requested to verify the validityof your bank account.
However, this Data is sent directly to Drouot SI’s payment service provider, (which is a PCI-DSS-certified
company), through its own services. We do not hold such Data, we only have a footprint of it. Its collection
and processing is governed by this company's own terms and conditions.
4. Purposes of collecting your DataYour Data are collected to enable us to provide you with the Services for one or more of the following
purposes:- Creation of an account on one of the Platforms,- Enabling you to use one of the Platforms,- Providing you with a history and details of your purchases and the number and amounts of your
bids,
2

-

-

-

Ensuring the proper execution of transactions initiated by Users such as: sales registrations,
Absentee Bids, placing bids, purchases, payments and deliveries,
Offering efficient customer service, particularly in terms of helping users of one of the Platforms,
and complaint management,
Compiling a file of Users, customers and prospects,
Send Newsletters, solicitations and promotional messages according to the preferences selected
when registering for one our website among the categories of objects offered under the conditions
detailed below or the behavior observed during your navigation ("Newsletter "),- Suggest, when you connect to the website, objects according to the preferences defined by you
during your registration or observed during your navigation,Compiling sales and traffic statistics
for our Services internally,
Managing outstanding payments and any disputes sent by sales operators regarding the use of ourServices,
Combating fraud,
Managing your requests for the right to access, rectify and object to the collection of your Data,
Complying with our legal and regulatory obligations.

We inform you, when collecting your Data, if certain Data must be entered or if this is optional. If you do
not complete these required fields, you will not be able to access the Services.
You can sign up to our Newsletter when you register or, later, by accessing your personal space from yourAccount. Your consent is obtained by ticking a box.
You can unsubscribe from Newsletters at any time by accessing your personal space from your Accountin the "personal information" block in the "Profile" section or by clicking on the unsubscribe link foundat the bottom of the emails received.
If the unsubscribe link malfunctions, you can unsubscribe by sending a message to the following
address: info@drouot.com.
5. Recipients of the Dataa. Sales operators
To find out more, we suggest that you read their privacy policies. You will then know how sales operators
use your Data when they act as data controller for the running of Live Sales, Timed Sales and BuyNow
Sales, the auction, payment and delivery of lots to the successful bidder.
A sales operator is a natural person or legal entity that arranges auctions. It uploads Traditional Catalogued
Sales, Live Sales or Timed Sales or Aftersale on one of the for use by Users.
This person can be:••

A voluntary auctioneer carrying out voluntary sales in accordance with the regime prescribed by
Articles L.321-1 of the Commercial Code ((Voluntary auctioneer, notaries, bailiffs, sworn
merchandise brokers, estate service, customs service fulfilling the conditions specified in thecommercial code);
A legal Public Auctioneer, public officer and ministerial officer responsible for carrying out theappraisal, the valuation and the legal sale at public auction of the furniture and chattels governedby the laws of 10 July 2000 and 20 July 2011.
3

•Anyone holding a certificate of aptitude for the profession of “commissaire de justice” in chargeof carrying out the appraisal, auction, and judicial sale by public auction of furniture and personal
effects whose activity is governed by law. known as “Macron” of August 6th, 2015;• Any person authorized to carry out auctions within the meaning of Articles L.322-1 et seq. Of theCommercial Code (notaries, bailiffs, sworn merchandise brokers);• Any person authorised to hold auctions in any other country and, in particular:• In Belgium, any person who has requested the presence of a ministerial officer to record
the sale in the minutes;• In Italy, any company registered as such, having obtained a commercial sales licence issued
by the Chamber of Commerce and a public safety licence issued by a special police force;• In Germany, the Versteigerer, counterpart of the French voluntary auctioneer, who is anindependent professional of more than 25 years who has been judged to be of high moral
standing and who has obtained administrative authorisation to carry out auctions.
During Buynow Galery Sales, the Sales Operator may also designate any professional wishing to sell atfixed price items on one of the Platforms independently of Live or Timed Sale.
- To manage your Absentee Bids or your online bids: we share some of your information with thesales operators to enable you to make an Absentee Bid or bid online on one of the Platforms. The
sales operator thus checks your identity and meets the legal anti-money laundering obligation towhich it is subject. Your identity data is then disclosed;-

We also send your email or telephone number to sales operators so that they can contact you if
necessary;-

When sales operators manage the payment of your auction purchases themselves, we send them
the necessary information, such as the amount of your bid and the nature of the lot won;-

We may only share your Data with sales operators for direct marketing purposes with youragreement via a tick box when you register for one of the Platforms. When you have given us yourconsent, we undertake to share your Data only with sales operators and art professionals who use
our services.

b. Our service providers
We share your Data with our own service providers located in the European Union, in particular to
perform services and actions on request and on behalf of Drouot SI, such as checking the validity of yourtelephone number or ID, sending promotional and marketing emails or text messages or enabling you tomanage your transactions.
Our service provider Selligent also uses your connection data to establish your preferences in terms ofitems categories. Drouot SI will thus be able to send you Newsletters corresponding to these preferences.
We use and process your login data to identify, delineate and eliminate malfunctions and errors intelecommunication systems.
If the conditions are met, we may use the login data to detect any illegal use of telecommunication systems
and services.

4

c. The Drouot Group companies
As Drouot SI is a subsidiary of the Drouot Group, it will be able to communicate your Data to any Drouot
Group company in order to inform you about the services offered by the Drouot Group companies.
d. The legal authorities
In accordance with the legal provisions in force, Drouot SI may be required to provide information to thecompetent authorities and courts for the purposes of criminal proceedings. Drouot SI may not notify youof the disclosure of your Data to authorised third parties.
6. Data Retention Period
We retain your Data only for the period necessary for the performance of our Services and up to 3 years
after the last use of your User Account.
After this 3-year period, Drouot SI may contact you again to invite you to log in to your Account withina period of 15 days. In the absence of positive and express action on your part, the Account will bedeactivated and the related data will be deleted or anonymised in accordance with the legal provisions inforce.
In the event of a breach of the General Terms and Conditions of Use or this Privacy Policy, Drouot SI
reserves the right to suspend your Account or to deactivate it definitively under the conditions describedin the General Terms and Conditions of Use.

7. List of bad payers
In the event of a payment default by a Bidder at the end of the reminder procedure described in the
General Terms and Conditions of Use, you agree that Drouot SI will keep your Data on a blacklist of bad
payers for a maximum period of 3 years in order to prohibit you from using our Services during thisperiod.
If you are registered on this list, you will be informed at the time of registration.
If the incident is resolved, your Data will be completely removed from the blacklist.
In the event of a dispute concerning inclusion on such a list, the User may contact Drouot SI on theconditions described in Article 11.
8. Closure of your AccountIf you have created an Account and wish to close it, please write to us at the address shown in Article 15.
Once your request has been received, we will deactivate your Account and delete or anonymise your Data
within a maximum of two months of your request.

5In addition, if your Account is not used for more than 3 years, Drouot SI reserves the right to deactivate
your Account, subject to sending a prior email inviting you to connect to your Account within 15 days. If
you do not log in, we will deactivate it and delete or anonymise your Data which will then be used only
for internal statistical purposes.
9. Security
We have implemented technical and organisational security measures to ensure the security, integrity andconfidentiality of all of your Data to prevent it from being lost, stolen, damaged, distorted or distributed
to unauthorised persons.
In addition, you are responsible for ensuring the confidentiality of the password that allows you to accessyour Account. Do not share this information with anyone. If you share your computer, don’t forget to log
out before leaving one of the Platforms.
We do not have access to your password. We cannot, therefore, send you your password if you forget it.
However, you can change it at any time on one of the Platforms via the password reset procedure.
We store your Data on servers located within the European Union.
10. Cookies
Cookies are text files stored in your browser. They are created when a User’s browser loads a given website:
the site sends information to the browser, which then creates a text file.
Each time you return to the same site, the browser retrieves the file and sends it to the website server.
When you first visit one of the, a warning banner appears asking if you agree to the use of cookies whilebrowsing. These cookies will be activated once you have given your permission.
This banner informs you that, by continuing to visit the Platform, you are deemed to agree to the use of
cookies, for which your permission is required, during your browsing.
You can also continue to browse while refusing cookies under the conditions described below.
a. Cookies used
Drouot SI uses the services of Google Analytics to collect information about your use of the Platforms.
Google Analytics is a marketing analytics service operated by Google Inc., 1600 Amphitheatre Parkway,
Mountain View, CA 94043, USA.
Google Analytics uses text and digit codes that will be stored on your device and that will analyse the useof the Services.
The information generated by cookies about your use of the Services (including your IP address) will betransferred to and stored by a Google server.
Google will use this information to assess your use of the Services, prepare activity reports for site
operators and provide other services related to the use of sites and the Internet.
Google may transfer this information to third parties if required by law or if third parties process this data
on behalf of Google.
6Google Analytics stores information about:- The pages you visit on Platforms;- The time you spend on each of these pages;- The links that made it possible to arrive on Platforms;- What you click on when browsing Platforms.
We do not use re-targeting advertising cookies or any other pixel advertising prospecting service indicating
whether users have performed specific actions on a site after clicking on an advertisement appearing on
one of the pages.
Google Analytics uses the following cookies:
Name Expiry
Role_ga
14 months Indicates how many people visit Platforms, distinguishing users who havealready visited the Platform.
_gat
10 minutes Used to monitor how often web page requests are madeb. Purpose of using cookies
The cookies we send allow us to:- compile statistics and volumes of visits and use of the various features of Platforms (sections andcontent visited, routes), enabling us to improve the interest and ergonomics of our Services;- Adapt how Platforms is presented to the display preferences of your device (language used, display
resolution, operating system used, etc.) during your visits to Platforms, depending on the hardware
and software used by your device to view or read content.
c. Managing cookie settings
To refuse cookies but continue to browse, you can change your settings in your browser at any time.
Each browser’s configuration for the management of cookies and your choices is different. Your browser's
help menu will tell you how to change your preferences regarding cookies. You will find information below
about the main browsers.
- Internet Explorer- Google Chrome- Safari- Firefox
Any reconfiguration may change your browsing on the Internet and your conditions of access to certain
Services requiring the use of cookies.
We do not accept any liability whatsoever for the consequences associated with the reduced operation ofcertain Services, resulting from the inability to save or consult the cookies necessary for their operation
and which you have refused or deleted.
You can also choose to object specifically and solely to Google Analytics cookies by installing theadditional unit accessible by clicking on the following link:
https://tools.google.com/dlpage/gaoptout?hl=None711. User’s Rights
The Data provided are necessary for the performance of the contract for the provision of Services towhich you have agreed. You may, therefore, not withdraw your consent to the processing of Data
necessary for the performance of the Service, unless you cease using the Services.
However, you may consult, modify or request the deletion of your Data for legitimate reasons at any timeusing the contact details specified in Article 15 below. These requests will be implemented within twomonths of your request. Since 25 May 2018, requests to restrict the processing or portability of the Data
have been made on the same conditions.
You may also object at any time to the processing of your Data to which you have previously given specificconsent for marketing purposes.
Drouot SI provides you, free of charge, with information relating to the Data stored about you.
Information may be provided electronically if you wish.
For your security, please understand that in the event of a request for information or modification, we
need to verify your identity. Your ID will not be retained following your request.
Drouot SI undertakes to notify all recipients of the Data processing of your request.
12. Treatment of data after death
You have the right to compile guidelines, to which you have specifically consented, relating to theretention, erasure and disclosure of your Data after your death. You may change or revoke these guidelines
at any time.
You may appoint a person to carry out your guidelines. Upon your death, Drouot SI will consult theguidelines and request that they be implemented. Where you have made no such designation or, unlessotherwise directed, in the event of the death of the person, your heirs have the capacity to read yourguidelines and request that Drouot SI implements them.
In the absence of any guidelines or of anything to the contrary in your guidelines, your heirs may exercise
your rights to the extent necessary for the following purposes:- Organisation and settlement of your estate. As such, your heirs can access the Data processing
concerning you in order to identify and obtain information useful for the liquidation and sharingof the estate. They may also be provided with digital goods or family-related data that can be passed
on to heirs;- Drouot SI’s processing of your death. For this purpose, your heirs may have your Accounts closed,
object to the continued processing of Data concerning you or have them updated.
When requested by your heirs, Drouot SI shall provide evidence, at no cost to the applicant, that thetransactions required by the heirs have been carried out.
Disagreements between heirs regarding the exercise of these rights will be brought before the competentHigh Court.

813. Change to the privacy policy
Drouot SI reserves the right to amend the Privacy Policy at any time, and this remains applicable for theentire duration of the use of Platforms and Services. In the event of a change, Drouot SI will inform youby email.
If you decline such changes, you agree to cease using the Services. Otherwise, your use of the Services issubject to the terms of the new version of the Privacy Policy.
Where you access the Services after being notified by Drouot SI of the new version of the Privacy Policy,
you are deemed to have accepted this new version of the Privacy Policy in full.
The new version of the Privacy Policy applicable to the Services is available on thePlatforms. Drouot SI
invites you to consult this regularly.
Drouot SI also reserves the right to modify or suspend, without giving any reason, all or part of theServices.
No compensation is payable to you for any modification or deletion of the Services.
14. Disputes
In the event of a dispute concerning the use of your Data, you may refer the matter to the French National
Data Protection Authority (the CNIL).
15. Contact
You can send any questions about your Data and how we use it directly to: info@drouot.com or to thefollowing postal address: Drouot SI - 18 boulevard Montmartre - 75009 Paris.
If you want to delete your Account or to exercise your right to object, question, access, correct or remove
the Data, you can contact us at the same addresses on the conditions described in Article 11 above.

9